- wlug - list.wlug.org.nz

The hijacking flaw that lurked in Intel chips is worse than anyone thought
by Peter Reutemann 08 May '17

08 May '17

'A remote hijacking flaw that lurked in Intel chips for seven years was more severe than many people imagined, because it allowed hackers to remotely gain administrative control over huge fleets of computers without entering a password. This is according to technical analyses published Friday. As Ars reported Monday, the authentication bypass vulnerability resides in a feature known as Active Management Technology. AMT, as it's usually called, allows system administrators to perform a variety of powerful tasks over a remote connection. Among the capabilities: changing the code that boots up computers, accessing the computer's mouse, keyboard, and monitor, loading and executing programs, and remotely powering on computers that are turned off. In short, AMT makes it possible to log into a computer and exercise the same control enjoyed by administrators with physical access. AMT, which is available with many vPro processors, was set up to require a password before it could be remotely accessed over a Web browser interface. But, remarkably, that authentication mechanism can be bypassed by entering any text string—or no text at all. According to a blog post published Friday by Tenable Network Security, the cryptographic hash that the interface's digest access authentication requires to verify someone is authorized to log in can be anything at all, including no string at all.' -- source: https://arstechnica.com/security/2017/05/the-hijacking-flaw-that-lurked-in-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Debian 8.8 Released
by Peter Reutemann 07 May '17

07 May '17

'The Debian Project announced today Debian GNU/Linux 8.8, the most advanced stable version of the Jessie series, which brings corrections for numerous packages and various security flaws discovered and patched since the release of the Debian GNU/Linux 8.7 maintenance update back in mid-January 2017... "This update mainly adds corrections for security problems to the stable release, along with a few adjustments for serious problems. Security advisories were already published separately and are referenced where available," reads today's announcement. "Please note that this update does not constitute a new version of Debian 8 but only updates some of the packages included. There is no need to throw away old 'jessie' CDs or DVDs but only to update via an up-to-date Debian mirror after an installation, to cause any out of date packages to be updated." Debian 8.8 contains more than 150 bug fixes and security updates.' -- source: https://linux.slashdot.org/story/17/05/06/2243254 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Docs phishing problem
by Ian Young 05 May '17

05 May '17

As seen in an ITP weekly update. Spear phishing This one will definitely leave a mark and I suspect we'll be seeing waves from it for years to come. Google Docs have become a default mechanism for sharing and collaborating on single documents. For those of you not in the realm of writing stuff for a living, you possibly don't know about the special circle of hell reserved for those who don't track changes or for the group email that results in 50 different versions of the same document that need to be subsumed into one. Google Docs has meant everyone can work on the one piece at the same time and when they've exhausted their pedantic nit-picking about fonts, Oxford commas or whether Kiwi needs to be upper or lower case (upper case for New Zealanders, lower case for the bird or the dollar) then you can simply print it off and be done. Now some bugger has gone and ruined it for all by releasing a nasty phishing attack which sends out a spam inviting you to edit a Google Doc, then raiding your contacts and spamming all of them with the same message. By now it will have more email addresses than there are grains of sand on Whangapoua beach. Google has rushed out the big guns to take on the phish and says it has managed to shut it down (I haven't seen it at all, so I'm pleased about that) but already the damage will be done. These kinds of attacks simply undermine what makes the internet so useful - the openness of it all. One day soon the whole thing will be locked down (I see the newest version of Windows only allows apps to be installed from Microsoft's own app store) and the value and character that makes the internet what it is will be gone. The Verge - Google Docs users hit with sophisticated phishing attack Wired - Don't Open That Google Doc Unless You're Positive It's Legit CNN - Major phishing attack targets Google Docs users

1 0

Google Releases DIY Open Source Raspberry Pi Voice Kit Hardware
by Peter Reutemann 05 May '17

05 May '17

'Google has decided to take artificial intelligence to the maker community with a new initiative called AIY. This initiative will introduce open source AI projects to the public that makers can leverage in a simple way. Today, Google announces the first-ever AIY project. Called "Voice Kit," it is designed to work with a Raspberry Pi 3 Model B to create a voice-based virtual assistant. Billy Rutledge, Director of AIY Projects for Google, explains, "The first open source reference project is the Voice Kit: instructions to build a Voice User Interface (VUI) that can use cloud services (like the new Google Assistant SDK or Cloud Speech API) or run completely on-device. This project extends the functionality of the most popular single board computer used for digital making -- the Raspberry Pi. The included Voice Hardware Accessory on Top (HAT) contains hardware for audio capture and playback: easy-to-use connectors for the dual mic daughter board and speaker, GPIO pins to connect low-voltage components like micro-servos and sensors, and an optional barrel connector for dedicated power supply. It was designed and tested with the Raspberry Pi 3 Model B."' -- source: https://hardware.slashdot.org/story/17/05/04/208240 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

No More FTP At Debian
by Peter Reutemann 04 May '17

04 May '17

'It looks like anonymous FTP is officially on its way out. While many public repositories have deprecated it in favor of HTTP, I was rather surprised to see Debian completely drop it on their public site. In a blog post, the team cited the FTP's lack of support for caching or acceleration, and declining usage as some of the reasons for their decision.' -- source: https://tech.slashdot.org/story/17/05/04/1731227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Distro Count
by Lawrence D'Oliveiro 03 May '17

03 May '17

I can remember reports from several years ago that distrowatch.com was tracking about 350 different Linux distros. Curious to know what the situation is like now, I went to their home page a few minutes ago, and counted the number of “<option ...>” entries in the “Select Distribution” popup menu at the top, and got 290. This figure also includes a few non-Linux OSes. But even so, I think it’s fair to say the sheer variety of Linux distros has scarcely abated over the last decade.

1 0

Linux Kernel 4.11 Officially Released
by Peter Reutemann 02 May '17

02 May '17

'Linux kernel 4.11 has been in development for the past two months, since very early March, when the first Release Candidate arrived for public testing. Eight RCs later, we're now able to download and compile the final release of Linux 4.11 on our favorite GNU/Linux distributions and enjoy its new features. Prominent ones include scalable swapping for SSDs, a brand new perf ftrace tool, support for OPAL drives, support for the SMC-R (Shared Memory Communications-RDMA) protocol, journalling support for MD RAID5, all new statx() system call to replace stat(2), and persistent scrollback buffers for VGA consoles... The Linux 4.11 kernel also introduces initial support for Intel Gemini Lake chips, which is an Atom-based, low-cost computer processor family developed using Intel's 14-nanometer technology, and better power management for AMD Radeon GPUs when the AMDGPU open-source graphics driver is used.' -- source: https://linux.slashdot.org/story/17/05/01/0534253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

UEFI Secure Boot Booted From Debian 9 'Stretch'
by Peter Reutemann 02 May '17

02 May '17

'In a release update from last week, release team member Jonathan Wiltshire wrote that "At a recent team meeting, we decided that support for Secure Boot in the forthcoming Debian 9 'stretch' would no longer be a blocker to release. The likely, although not certain outcome is that stretch will not have Secure Boot support." "We appreciate that this will be a disappointment to many users and developers," he continued, "However, we need to balance that with the limited time available for the volunteer teams working on this feature, and the risk of bugs being introduced through rushed development." The decision not to offer Secure Boot support at release leaves Debian behind Red Hat and Suse, making it the only one of Linux's three main branches not to support the heir-to-BIOS and the many security enhancements it offers.' -- source: https://linux.slashdot.org/story/17/05/01/1452209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intel Patches Remote Execution Hole That's Been Hidden In Its Chips Since 2008
by Peter Reutemann 02 May '17

02 May '17

'Intel processor chipsets have, for roughly the past nine years, harbored a security flaw that can be exploited to remotely control and infect vulnerable systems with virtually undetectable spyware and other malicious code. Specifically, the bug is in Intel's Active Management Technology (AMT), Standard Manageability (ISM) and Small Business Technology (SBT) firmware versions 6 to 11.6. According to Chipzilla, the security hole allows "an unprivileged attacker to gain control of the manageability features provided by these products." That means hackers exploiting the flaw can silently snoop on a vulnerable machine's users, make changes to files and read them, install rootkits and other malware, and so on. This is possible across the network, or with local access. These management features have been available in various Intel chipsets for years, starting with the Nehalem Core i7 in 2008, all the way up to Kaby Lake Core parts in 2017. According to Intel today, this critical security vulnerability, labeled CVE-2017-5689, was found and reported in March by Maksim Malyutin at Embedi. To get the patch to close the hole, you'll have to pester your machine's manufacturer for a firmware update, or try the mitigations here. These updates are hoped to arrive within the next few weeks.' -- source: https://hardware.slashdot.org/story/17/05/01/228211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Interviewed By Bryan Lunduke
by Peter Reutemann 26 Apr '17

26 Apr '17

'Many Slashdot readers know Bryan Lunduke as the creator of the humorous "Linux Sucks" presentations at the annual Southern California Linux Exposition. He's now also a member of the OpenSUSE project board and an all-around open source guy. (In September, he released every one of his books, videos and comics under a Creative Commons license, while his Patreon page offers a tip jar and premiums for monthly patrons). But now he's also got a new "daily computing/nerd show" on YouTube, and last week -- using nothing but free software -- he interviewed the 64-year-old founder of the Free Software Foundation, Richard Stallman. "We talk about everything from the W3C's stance on DRM to opinions on the movie Galaxy Quest," Lunduke explains in the show's notes.' -- source: https://news.slashdot.org/story/17/04/24/0738250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Systemd-Free Devuan Announces Its First Stable Release Candidate 'Jessie' 1.0.0
by Peter Reutemann 26 Apr '17

26 Apr '17

' Devuan 1.0.0-RC is announced, following its beta 2 release last year. The Debian fork that spawned over systemd controversy is reaching stability and plans long-term support. Devuan deploys an innovative continuous integration setup: with fallback on Debian packages, it overlays its own modifications and then uses the merged source repository to ship images for 11 ARM targets, a desktop and minimal live, vagrant and qemu virtual machines and the classic installer isos. The release announcement contains several links to projects that have already adopted this distribution as a base OS. "Dear Init Freedom Lovers," begins the announcement, "Once again the Veteran Unix Admins salute you!" It points out that Devuan "can be adopted as a flawless upgrade path from both Debian Wheezy and Jessie. This is a main goal for the Devuan Jessie stable release and has proven to be a very stable operation every time it has been performed. "' -- source: https://linux.slashdot.org/story/17/04/22/1822216 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Anbox Can Run Android Apps Natively On Linux (In A Container)
by Peter Reutemann 26 Apr '17

26 Apr '17

'Canonical engineer Simon Fels has publicly released an Alpha version of Anbox. Similar to the method employed for Android apps on ChromeOS, Anbox runs an entire Android system (7.1.1 at present) in an LXC container. Developed over the last year and a half, the software promises to seamlessly bring performant Android apps to the Linux desktop. After installing Anbox (based on Android 7.1.1) and starting Anbox Application Manager, ten apps are available: Calculator, Calendar, Clock, Contacts, Email, Files, Gallery, Music, Settings, and WebView. Apps run in separate resizeable windows. Additional apps (ARM-native binaries are excluded) can be installed via adb. Installation currently is only supported on a few Linux distributions able to install snaps. Contributions are welcome on Github. In a blog post Simon describes it as "a side project" that he's worked on for over a year and a half. "There were quite a few problems to solve on the way to a really working implementation but it is now in a state that it makes sense to share it with a wider audience."' -- source: https://news.slashdot.org/story/17/04/22/207253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux PC Maker System76 Plans To Design And Manufacture Its Own Hardware
by Peter Reutemann 26 Apr '17

26 Apr '17

'System76 is one of only a handful of PC vendors that exclusively sells computers with Linux-based software. Up until now, that's meant the company has chosen hardware that it could guarantee would work well with custom firmware and the Ubuntu Linux operating system... Starting in 2018 though, you may be able to buy a System76 computer that was designed and built in-house... CAD files for System76 computers will be open source, allowing anyone with the appropriate skills and equipment to build or modify their own cases based on the company's designs. "We're prototyping with acrylic and moving to metal soon," the company says in a blog post, adding "Our first in-house designed and manufactured desktops will ship next year. Laptops are more complex and will follow much later."' -- source: https://hardware.slashdot.org/story/17/04/23/0325234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Linux Foundation Launches IoT-focused Open Source EdgeX Foundry
by Peter Reutemann 26 Apr '17

26 Apr '17

'The Linux Foundation launches the open source EdgeX Foundry -- an attempt to unify and simplify the Internet of Things. The Linux Foundation says, "EdgeX Foundry is unifying the marketplace around a common open framework and building an ecosystem of companies offering interoperable plug-and-play components. Designed to run on any hardware or operating system and with any combination of application environments, EdgeX can quickly and easily deliver interoperability between connected devices, applications, and services, across a wide range of use cases. Interoperability between community-developed software will be maintained through a certification program."' -- source: https://linux.slashdot.org/story/17/04/24/1511239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux 4.11 Delayed For a Week
by Peter Reutemann 26 Apr '17

26 Apr '17

'Linux kernel creator Linus Torvalds said over the weekend that v4.11 version of Linux has hit a speed bump in the form of "NVMe power management that apparently causes problems on some machines." The Register adds: "It's not entirely clear what caused the [NVMe] issue (it wasn't just limited to some NVMe hardware, but also particular platforms), but let's test it." Which sounds like a good idea, given that flash memory on the PCIe bus is increasingly mainstream. That problem and "a couple of really annoying" bugs mean that Torvalds has decided to do an eighth release candidate for Linux 4.11. "I did get fixes for the issues that popped up, so I could have released 4.11 as-is," Torvalds wrote, "but it just doesn't feel right."' -- source: https://linux.slashdot.org/story/17/04/24/1633209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canadian Regulator Puts Foot Down On Net Neutrality
by Lawrence D'Oliveiro 23 Apr '17

23 Apr '17

While the Trump administration has rolled back consumer protections on net neutrality in the USA, the Canadian CRTC has come out firmly in favour of it <https://www.theregister.co.uk/2017/04/21/canada_net_neutrality/>. It has said that “zero rating”--the practice of ISPs favouring certain online services by not counting them towards data caps, is bad because differential pricing practices, generally speaking, result in (a) a preference toward certain subscribers over others, (b) a preference toward certain content providers over others, (c) a disadvantage to subscribers who are not eligible for, or interested in, a differential pricing practice offering, and (d) a disadvantage to content providers that are not eligible for, or included in, an offering. In other words, they are anticompetitive, no matter what some may try to argue.

1 1

File System Improvements To the Windows Subsystem for Linux
by Peter Reutemann 21 Apr '17

21 Apr '17

'In the latest Windows Insider build, the Windows Subsystem for Linux (WSL) now allows you to manually mount Windows drives using the DrvFs file system. Previously, WSL would automatically mount all fixed NTFS drives when you launch Bash, but there was no support for mounting additional storage like removable drives or network locations. Now, not only can you manually mount any drives on your system, we've also added support for other file systems such as FAT, as well as mounting network locations. This enables you to access any drive, including removable USB sticks or CDs, and any network location you can reach in Windows all from within WSL.' -- source: https://tech.slashdot.org/story/17/04/20/1422256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Unicode In Domain Names Opens Up Homograph Attacks
by Lawrence D'Oliveiro 19 Apr '17

19 Apr '17

The problem is not new: it was identified over a decade ago. But no fix has been forthcoming. <https://www.theregister.co.uk/2017/04/18/homograph_attack_again/>

1 1

meeting next Monday
by Peter Reutemann 18 Apr '17

18 Apr '17

Hi everyone We have a meeting coming up on Monday next week: "With Canonical killing off its desktop environment Unity in favor of GNOME, let's have a look at some of the available desktop environments: - Ian Stewart: Ubuntu 17.04 with Unity - William Mckee: LXDE - Peter Reutemann: MATE (vanilla and mint-flavored) Also, Ian Young: Getting a DVB-T card for laptops going - a live experiment." Details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234793/ If you want to demo another desktop environment, like KDE or XFCE, then please let me know. Always looking for volunteers! :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

demo at meeting on Monday
by Ian Young 17 Apr '17

17 Apr '17

Afraid I won't be talking about Unity as Ian S has suggested - I have only ever used it briefly and never really quite got what it was all about. However if there is any spare time I could bring a DVB-T card for use with laptops I got recently. It seems to be a live one, lights up and is seen by a laptop and various Linux software applications for viewing TV. Alas, not scanning any channels. Perhaps someone knows all about this, or at any rate more than I do. The device in question is badged as an HP EC300 and has a DIBcom chipset. ~ Ian Y

4 3

suggestion for upcoming meeting
by Peter Reutemann 15 Apr '17

15 Apr '17

Hi everyone With Canonical pulling out of Unity development, how about we showcase the various desktops that have been available for a long time and are *still* available at the next meeting (April 24th)? If you want to present one, then please reply to this list naming the desktop of your choice. Thanks. Cheers, Peter PS And stay safe with Cyclone Cook! The next 24 hours will be interesting... -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Dozens Of Canonical Employees Resign As Ubuntu Switches To GNOME, Shuttleworth Returns As CEO
by Peter Reutemann 12 Apr '17

12 Apr '17

'More than 80 Canonical workers are facing the axe as founder Mark Shuttleworth has taken back the role of chief executive officer. The number, revealed today by The Reg, comes as Shuttleworth assumed the position from CEO of eight years Jane Silber, previously chief operating officer. The Reg has learned 31 or more staffers have already left the Ubuntu Linux maker ahead of Shuttleworth's rise, with at least 26 others now on formal notice and uncertainty surrounding the remainder. One individual has resigned while others, particularly in parts of the world with more stringent labour laws (such as the UK), are being left in the dark. The details come after The Reg revealed plans for the cuts as a commercial get-fit programme instituted by Shuttleworth. The Canonical founder is cutting numbers after an external assessment of his company by potential new financial backers found overstaffing and that projects lacked focus.' -- source: https://news.slashdot.org/story/17/04/12/1844230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Kodi Development Team Wants To Be Legitimate and Bring DRM To the Platform
by Peter Reutemann 11 Apr '17

11 Apr '17

'The XBMC/ Kodi development team has taken a lot of heat over the years, mostly due to third-party developers introducing piracy plugins to the platform. In many cases, cheap Android computers are often sold with these plugins pre-installed with the Kodi or XBMC name attached to them -- something that caused Amazon to ban sales of such devices. The Kodi team is not happy about this, and has taken the fight to the sellers. The Kodi team is now trying to work with rights holders to introduce DRM and legitimate plugins to the platform. Is this the first step towards creating a true one-stop do it yourself Linux entertainment system?' -- source: https://yro.slashdot.org/story/17/04/11/1911215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Founder Criticizes Free Software Developers Who 'Hate On Whatever's Mainstream'
by Peter Reutemann 10 Apr '17

10 Apr '17

'Canonical Founder Mark Shuttleworth said Saturday that "I came to be disgusted with the hate" on Canonical's display server Mir, saying it "changed my opinion of the free software community." After announcing his company was abandoning Unity for GNOME, Shuttleworth posted a gracious thank-you note to the Unity community Friday on Google Plus. But on Saturday, he added a sharper comment: "I used to think that it was a privilege to serve people who also loved the idea of service, but now I think many members of the free software community are just deeply anti-social types who love to hate on whatever is mainstream. When Windows was mainstream they hated on it. Rationally, Windows does many things well and deserves respect for those. And when Canonical went mainstream, it became the focus of irrational hatred too. The very same muppets would write about how terrible it was that IOS/Android had no competition and then how terrible it was that Canonical was investing in (free software!) compositing and convergence. Fuck that shit." The comment begins by saying "The whole Mir hate-fest boggled my mind - it's free software that does something invisible really well. It became a political topic as irrational as climate change or gun control, where being on one side or the other was a sign of tribal allegiance. We have a problem in the community when people choose to hate free software instead of loving that someone cares enough to take their life's work and make it freely available."' -- source: https://news.slashdot.org/story/17/04/09/1829209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Smart TV hack embeds attack code into broadcast signal—no access required
by Chris O'Halloran 06 Apr '17

06 Apr '17

https://arstechnica.co.uk/security/2017/04/smart-tv-hack-embeds-attack-code… A new attack that uses terrestrial radio signals to hack a wide range of Smart TVs raises an unsettling prospect—the ability of hackers to take complete control of a large number of sets at once without having physical access to any of them.

1 0

Android devices can be fatally hacked by malicious Wi-Fi networks
by Peter Reutemann 06 Apr '17

06 Apr '17

'A broad array of Android phones is vulnerable to attacks that use booby-trapped Wi-Fi signals to achieve full device takeover, a researcher has demonstrated. The vulnerability resides in a widely used Wi-Fi chipset manufactured by Broadcom and used in both iOS and Android devices. Apple patched the vulnerability with Monday's release of iOS 10.3.1. "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip," Apple's accompanying advisory warned. In a highly detailed blog post published Tuesday, the Google Project Zero researcher who discovered the flaw said it allowed the execution of malicious code on a fully updated 6P "by Wi-Fi proximity alone, requiring no user interaction." Google is in the process of releasing an update in its April security bulletin. The fix is available only to a select number of device models, and even then it can take two weeks or more to be available as an over-the-air update to those who are eligible. Company representatives didn't respond to an e-mail seeking comment for this post.' -- source: https://arstechnica.com/security/2017/04/wide-range-of-android-phones-vulne… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Killing Unity For Ubuntu Linux, Will Switch To the Superior GNOME
by Peter Reutemann 05 Apr '17

05 Apr '17

'Today, the company admits that it is throwing in the towel on Unity, as well as its vision for convergence with devices like phones and tablets. Starting with Ubuntu 18.04, the wonderful GNOME will once again become the default desktop environment! "We are wrapping up an excellent quarter and an excellent year for the company, with performance in many teams and products that we can be proud of. As we head into the new fiscal year, it's appropriate to reassess each of our initiatives. I'm writing to let you know that we will end our investment in Unity8, the phone and convergence shell. We will shift our default Ubuntu desktop back to GNOME for Ubuntu 18.04 LTS," says Mark Shuttleworth, Founder of Ubuntu and Canonical.' -- source: https://linux.slashdot.org/story/17/04/05/1812232 <rant> Well, looks like some consolidation is happening, not that I consider Gnome3 "superior". IMHO MATE is still far better (and making me more efficient) than Gnome3. Introducing dynamic workspaces was the worst decision ever... </rant> Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Samsung’s Tizen is riddled with security flaws, amateurishly written
by Peter Reutemann 05 Apr '17

05 Apr '17

'Tizen, the open source operating system that Samsung uses on a range of Internet-of-Things devices and positions as a sometime competitor to Android, is chock full of egregious security flaws, according to Israeli researcher Amihai Neiderman. Samsung has been developing the operating system for many years. The project started as an Intel and Nokia project, and Samsung merged its Bada operating system into the code in 2013. Like Android, it's built on a Linux kernel, with a large chunk of open source software running on top. App development on Tizen uses C++ and HTML5.' -- source: https://arstechnica.com/gadgets/2017/04/samsungs-tizen-is-riddled-with-secu… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fuchsia: Google's new operating system
by Bryan Baldwin 04 Apr '17

04 Apr '17

Fuchsia is a new operating system <https://lwn.net/SubscriberLink/718267/206c8a5fbf0ee2ea/> being built more or less from scratch at Google. The news of the development of Fuchsia made a splash on technology news sites in August 2016, although many details about it are still a mystery. It is an open-source project; development and documentation work is still very much ongoing. Despite the open-source nature of the project, its actual purpose has not yet been revealed by Google. From piecing together information from the online documentation and source code, we can surmise that Fuchsia is a complete operating system for PCs, tablets, and high-end phones. The source to Fuchsia and all of its components is available to download at its source repository <https://fuchsia.googlesource.com/>. If you enjoy poking around experimental operating systems, exploring the innards of this one will be fun. Fuchsia consists of a kernel plus user-space components on top that provide libraries and utilities. There are a number of subprojects under the Fuchsia umbrella in the source repository, mainly libraries and toolkits to help create applications. Fuchsia is mostly licensed under a 3-clause BSD license, but the kernel is based on another project called LK (Little Kernel) <https://github.com/littlekernel/lk> that is MIT-licensed, so the licensing for the kernel is a mix. Third-party software included in Fuchsia is licensed according to its respective open-source license. https://www.osnews.com/story/29747/Fuchsia_Google_s_new_operating_system

1 0

The r/place Experiment
by Lawrence D'Oliveiro 04 Apr '17

04 Apr '17

Over the April Fool’s weekend, Reddit, the (in)famous social-media and troll-hangout site, tried something very unusual: they created a blank 1000-by-1000-pixel canvas, and turned their users loose on it to draw whatever they liked. The only restriction was a limit on how quickly any one user could update the image: just 1 pixel every 5 minutes. The resulting time-lapse animation is quite breathtaking to watch <https://arstechnica.com/gaming/2017/04/in-memoriam-reddits-72-hour-live-gra…>. Look at the number of logos and national flags: a battle between the French and German flags gets resolved with the French one running its bars vertically, the German one horizontally, and an EU flag placed at the intersection; another brief skirmish between the Greek and Turkish flags gets resolved with them being placed side by side, joined by a heart. Yes, there are the occasional rude words. But it’s surprising how little of that kind of thing appears--or perhaps it was removed too quickly by competing groups with other fish to fry. Watch the animations a few times; you’ll see something new each time.

2 1

If-I-Buy-It-Do-I-Own-It Chapter 339: Tractors
by Lawrence D'Oliveiro 31 Mar '17

31 Mar '17

Owners of John Deere tractors are resorting to pirated firmware in order to gain the ability to repair their own property: <https://www.techdirt.com/articles/20170322/04582036973/tractor-owners-using…> Are farmers in NZ impacted by any of this? I see that John Deere tractors are indeed sold here.

2 1

Phrase Of The Week: “Necessary Hashtags”
by Lawrence D'Oliveiro 28 Mar '17

28 Mar '17

UK Home Secretary Amber Rudd’s immortal quotation has spawned a T-shirt: <https://www.techdirt.com/articles/20170327/20224837016/limited-edition-gear…>. Do you have the necessary hashtags? Do they come in a nice series of tubes?

1 0

After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Pasts Contributors
by Peter Reutemann 26 Mar '17

26 Mar '17

'After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site). "This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'" Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.' -- source: https://news.slashdot.org/story/17/03/26/2258218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Ubuntu Linux 17.04 'Zesty Zapus' Final Beta Now Available For Download
by Peter Reutemann 26 Mar '17

26 Mar '17

'The final beta of Ubuntu 17.04 'Zesty Zapus' became available for download Thursday. While it is never a good idea to run pre-release software on production machines, Canonical is claiming that it should be largely bug free at this point. In other words, if you understand the risks, it should be a fairly safe. Home users aside, this is a good opportunity for administrators to conduct testing prior to the official release next month. "The Ubuntu team is pleased to announce the final beta release of the Ubuntu 17.04 Desktop, Server, and Cloud products. Codenamed 'Zesty Zapus', 17.04 continues Ubuntu's proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution," says Adam Conrad, Canonical. "The team has been hard at work through this cycle, introducing new features and fixing bugs."' -- source: https://news.slashdot.org/story/17/03/25/2127238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

meeting next Monday
by Peter Reutemann 23 Mar '17

23 Mar '17

Hi everyone We have a WLUG meeting coming up next Monday: "William Mckee has been to nz.js.con recently and will talk about the A/V setup used for recording the presentations: hdmi2usb" https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234774/ BTW It's not too late if you still want to present something! Just email me. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

GNOME 3.24 Released
by Peter Reutemann 22 Mar '17

22 Mar '17

'GNOME 3.24 just finished its six-month development cycle, and it's now the most advanced stable version of the modern and popular desktop environment used by default in numerous GNU/Linux distributions. It was developed since October 2016 under the GNOME 3.23.x umbrella, during which it received numerous improvements. Prominent new features of the GNOME 3.24 desktop environment include a Night Light functionality that promises to automatically shift the colors of your display to the warmer end of the spectrum after sunset, and a brand-new GNOME Control Center with redesigned Users, Keyboard and Mouse, Online Accounts, Bluetooth, and Printer panels. As for the GNOME apps, we can mention that the Nautilus file manager now lets users browse files as root (system administrator), GNOME Photos imitates Darktable's exposure and blacks adjustment tool, GNOME Music comes with ownCloud integration and lets you edit tags, and GNOME Calendar finally brings the Week view. New apps like GNOME Recipes are also part of this release. The full release notes can be viewed here. Softpedia notes in conclusion: "As mentioned before, it will take at least a couple of weeks for the new GNOME 3.24 packages to land on the stable repositories of your favorite distro, which means that you'll most probably be able to upgrade from GNOME 3.22 when the first point release, GNOME 3.24.1, is out on April 12, 2017."' -- source: https://tech.slashdot.org/story/17/03/22/205210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox for Linux is Now Netflix Compatible
by Peter Reutemann 22 Mar '17

22 Mar '17

'For a while, Netflix was not available for traditional Linux-based operating systems, meaning users were unable to enjoy the popular streaming service without booting into Windows. This was due to the company's reliance on Microsoft Silverlight. Since then, Netflix adopted HTML5, and it made Google Chrome and Chromium for Linux capable of playing the videos. Unfortunately, Firefox -- the open source browser choice for many Linux users -- was not compatible. Today this changes, however, as Mozilla's offering is now compatible with Netflix!' -- source: https://news.slashdot.org/story/17/03/22/1510220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

suggestions for upcoming meeting?
by Peter Reutemann 19 Mar '17

19 Mar '17

Hi everyone Any suggestions for the upcoming meeting? https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234774/ Thanks. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

4 6

Big Surprise: HTTPS Interception Middleboxes Weaken Your Security
by Lawrence D'Oliveiro 17 Mar '17

17 Mar '17

Some companies run boxes that intercept outgoing TLS/SSL connections, by using their own certificates that employees’ machines are configured to accept, in order to enforce policies on access to outside sites. Trouble is, many of these boxes introduce their own vulnerabilities into the system, by allowing new kinds of attacks from outside. <https://www.theregister.co.uk/2017/03/17/are_you_undermining_your_web_secur…>

1 0

Microsoft Locks Ryzen, Kaby Lake Users Out of Updates On Windows 7, 8.1
by Peter Reutemann 17 Mar '17

17 Mar '17

'In a move that will shock a lot of people, someone at Microsoft decided to deny Windows 7/8.1 updates to the users of the following CPU architectures: Intel seventh (7th)-generation processors (Kaby Lake); AMD "Bristol Ridge" (Zen/Ryzen); Qualcomm "8996." It's impossible to find any justification for this decision to halt support for the x86 architectures listed above because you can perfectly run MS-DOS on them. Perhaps, Microsoft has decided that the process of foisting Windows 10 isn't running at full steam, so the company created this purely artificial limitation. I expect it to be cancelled soon after a wide backlash from corporate customers. KitGuru notes that users may encounter the following error message when they attempt to update their OS: "Your PC uses a processor that isn't supported on this version of Windows." The only resolution is to upgrade to Windows 10.' -- source: https://tech.slashdot.org/story/17/03/16/2047215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Canonical Preps Security Lifeboat, Yells: Ubuntu 12.04 Hold-Outs, Get In
by Peter Reutemann 15 Mar '17

15 Mar '17

'Canonical is extending the deadline for security updates for paying users of its five-year-old Ubuntu 12.04 LTS -- a first. Ubuntu 12.04 LTS will become the first Long Term Support release of Canonical's Linux to get Extended Security Maintenance (ESM). There are six LTS editions. All others have been end-of-lifed -- and given no security reprieve. LTS editions of Ubuntu Linux are released every two years. Desktop support runs for three years and the server edition receives security patches and updates for a period of five years. Security updates for 12.04 were scheduled to run out on April 28, 2017 but that now won't happen for those on Canonical's Ubuntu Advantage programme. They'll now receive important security fixes for the kernel and "most essential" userspace packages on their servers running 12.04. In what's shaping up to be Canonical's Windows XP moment over at Microsoft, the Linux spinner rolled out the lifeline because customers are clinging to 12.04.' -- source: https://linux.slashdot.org/story/17/03/15/1754232 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

From DoNotPay To DoNotDeport?
by Lawrence D'Oliveiro 14 Mar '17

14 Mar '17

Last year, a 19-year-old student named Josh Browder released a chatbot that helped people avoid paying illegal parking fines. Now he is adapting the same technology to areas like compensation for flight delays, the rights of those who are HIV-positive, and refugees trying to cope with foreign legal systems <https://www.techdirt.com/articles/20170308/10393436870/chatbot-that-helped-…>.

1 0

Debian Update: Stretch Frozen, Bug-Squashing Parties Planned
by Peter Reutemann 12 Mar '17

12 Mar '17

'"Debian project leader Mehdi Dogguy has written a status update concerning the work going on for the first two months of 2017," reports Phoronix. An anonymous reader quotes their report: So far this year Debian 9.0 Stretch has entered its freeze, bug squashing parties are getting underway for Stretch, the DebConf Committee is now an official team within Debian, a broad Debian Project roadmap is in the early stages of talk, and more. Bug-Squashing Parties have been scheduled this week in Germany and Brazil, with at least two more happening in May in Paris and Zurich, and for current Debian contributors, "Debian is willing to reimburse up to $100 (or equivalent in your local currency) for your travel and accommodation expenses for participating in Bug Squashing Parties..." writes Dogguy, adding "If there are no Bug Squashing Parties next to your city, can you organize one?"' -- source: https://linux.slashdot.org/story/17/03/12/2210215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New 'USG' Firewalls Protect USB Drives From Malicious Attacks
by Peter Reutemann 12 Mar '17

12 Mar '17

'A developer has created the USG, "a small, portable hardware USB firewall...to prevent malicious USB sticks and devices laden with malware from infecting your computer." An anonymous reader quotes ZDNet: The problem is that most computers automatically trust every USB device that's plugged in, which means malicious code can run without warning... Cars, cash registers, and some ATMs also come with USB ports, all of which can be vulnerable to cyberattacks from a single USB stick. That's where the USG firewall comes in...a simple hardware serial link that only accepts a very few select number of safe commands, which prevents the device from executing system commands or intercepting network traffic. That means the data can flow from the USB device, but [it] effectively blocks other USB exploits. The firmware has been open sourced, and the technical specifications have also been released online "to allow anyone to build their own from readily available development boards."' -- source: https://hardware.slashdot.org/story/17/03/11/1658238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Munich's IT Lead: 'No Compelling Reason' To Switch Back To Windows From Linux
by Peter Reutemann 12 Mar '17

12 Mar '17

'"The man who runs Munich's central IT says there is no practical reason for the city to write off millions of euros and years of work to ditch its Linux-based OS for Windows," reports TechRepublic. Long-time Slashdot reader Qbertino summarizes a German-language article: Karl-Heinz Schneider, lead of Munich's local system house company IT(a)M, goes on to claim, "We do not see pressing technical reasons to switch to MS and MS Office... The council [in their recent plans] didn't even follow the analysts' suggestion to stick with using LibreOffice." Furthermore, Schneider stated that "System failures that angered citizens in recent years never were related to the LiMux project, but due to new bureaucratic procedures..." and apparently decisions by unqualified personnel at the administrative level, as Munich's administration itself states.' -- source: https://linux.slashdot.org/story/17/03/11/0142247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux Foundation Chief: Businesses 'Will Fail' If They Don't Use Open Source Code
by Peter Reutemann 12 Mar '17

12 Mar '17

'First Vint Cert said there's a "thread of openness" that runs throughout the internet, adding that "the internet, itself, has open characteristics" and thrives on "permissionless innovation." And Eric Brewer, vice president of infrastructure at Google, touched on the same themes, according to Tech Republic. "Linux, Brewer said, won some of the early internet wars because it was open, but also because it was the most innovative of its time. He also said that companies should work with open source for the value of the ecosystem and community, not just the value of the code." Then Linux Foundation executive director Jim Zemlin told the audience that business models were already changing to include open source, and ultimately made the argument that organizations that "don't harvest the shared innovation" of open source "will fail." ' -- source: https://news.slashdot.org/story/17/03/12/0317215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Netflix access using Linux
by Roderick Aldridge 11 Mar '17

11 Mar '17

Does Spark prevent clients using Netflix under Linux? If so is there a work-around? Thanks for any info. Rod

3 5

Sensible Password Rules
by Lawrence D'Oliveiro 11 Mar '17

11 Mar '17

NIST came out last year with some guidelines on how to choose passwords <https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-y…>. The “dos” should not be too surprising, but it is worth mentioning the “don’ts”: * No restrictions on what characters are allowed * No password hints * No knowledge-based authentication * No expiration without some good reason Also, they are no longer recommending the use of SMS for two-factor authentication. I wonder what you should use instead?

1 0

Look before you paste from a website to terminal
by Peter Reutemann 11 Mar '17

11 Mar '17

'Most of the time when we see a code snippet online to do something, we often blindly copy paste it to the terminal. Even the tech savy ones just see it on the website before copy pasting. Here is why you shouldn't do this.' -- source: https://lifepluslinux.blogspot.co.nz/2017/01/look-before-you-paste-from-web… Hint: hidden commands thanks to HTML/CSS. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 2

Microsoft Continues Porting Visual C++ To Linux
by Peter Reutemann 11 Mar '17

11 Mar '17

'Long-time Slashdot reader Billly Gates shared some news from Microsoft's Visual C++ blog: Visual Studio 2017 now lets developers write C++ code for Linux desktops, servers, and other devices without an extension, targeting specific architectures, including ARM: Visual Studio will automatically copy and remotely build your sources and can launch your application with the debugger... Today Visual Studio only supports building remotely on the Linux target machine. It is not limited to specific Linux distros, but we do have dependencies on the presence of some tools. Specifically, we need openssh-server, g++, gdb and gdbserver. ' -- source: https://linux.slashdot.org/story/17/03/11/0431252 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

US ISP Verizon Wireless To Stop Giving Out Static IPv4 Addresses
by Lawrence D'Oliveiro 10 Mar '17

10 Mar '17

New business customers with Verizon Wireless will no longer get static IPv4 addresses. Instead, they will get “persistent prefix” IPv6 addresses <https://www.theregister.co.uk/2017/03/10/verizon_running_out_of_ipv4_addres…>. I assume “persistent prefix” means they get a fixed value for the top 48 bits, and they can do what they like with the bottom 80 bits. This /48 subnet allocation seems to be the common thing for IPv6.

1 0

Engineering Around Social Media Border Searches
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

In the wake of the plan floated by the US Government to demand passwords to social media accounts from people wanting to enter the country, here <http://freedom-to-tinker.com/2017/02/10/engineering-around-social-media-bor…> is a discussion of some likely countermeasures that should still give the cover of plausible deniability.

1 3

Quote Of The Week
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

“One of the reasons society hasn't destroyed itself is that people with intelligence and skills tend to not be criminals for a living. If it ever became a viable career path, we're doomed.” -- Bruce Schneier <https://www.schneier.com/blog/archives/2017/03/building_smarte.html>

1 0

Litebook launches a $249 linux laptop
by Ron Dean 07 Mar '17

07 Mar '17

Presumably this is in $US -- Ron Dean Unit 61 Village Gardens 16 Rototuna Road Hamilton 3210 New Zealand Home 64 7 8493904 Mob 02102259172

1 0

The City of Munich Might Stick With Linux
by Peter Reutemann 06 Mar '17

06 Mar '17

'Munich's "LiMux" project brought FOSS software to their city's IT administration -- until a vote last month on whether to abandon Linux and return to Windows. "Since this decision was reached, the majority of media have reported that a final call was made to halt LiMux and switch back to Microsoft software," reports the Free Software Foundation Europe. "This is, however, not an accurate representation of the outcome of the city council meeting." An anonymous reader quotes their report: The opposing parties were overruled, but the decision was amended such that the strategy document must specify which LiMux-applications will no longer be needed, the extent in which prior investments must be written off, and a rough calculation of the overall costs of the desired unification... [Only then will the city council make their final decision...] We succeeded thus far in forcing the mayor Dieter Reiter to postpone the final decision, and this was possible through the unwavering pressure created by joint efforts between The Document Foundation, KDE, OSBA, and the FSFE together with all the individuals who wrote to city council members and took the issue to the media. Although the mandate is highly suggestive in that it suggests that the existing vendor-neutral approach is to be replaced with a proprietary solution, it leaves the door open... The new mandate buys us some time. And we will keep going. Some politicians said they'd never received this much input from the public before, and the Free Software Foundation Europe says the city's issues were caused "from organizational problems, including lack of clear structures and responsibilities," which should not be attributed to the Linux operating system. "LiMux as such is still one of the best examples of how to create a vendor-neutral administration based on Free Software."' -- source: https://linux.slashdot.org/story/17/03/04/0532214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Litebook Launches A $249 Linux Laptop
by Peter Reutemann 06 Mar '17

06 Mar '17

'It's "like a Chromebook for Linux users on a budget," reports ZDNet. The new 2.9-pound Litebook uses Intel's Celeron N3150 processor and ships with a 14.1-inch display and a 512-gigabyte hard drive with full HD resolution (1,920 x 1,080). For $20 more they'll throw in a 32-gigabyte SSD to speed up your boot time. "Unlike Windows laptops, Litebooks are highly optimized, come without performance hogging bloatware, [are] designed to ensure your privacy, and are entirely free of malware and viruses," writes the company's web site. They also add that their new devices "are affordable, customizable, and are backwards compatible with Windows software."' -- source: https://linux.slashdot.org/story/17/03/06/0050203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Endorses DRM In HTML5, Offers Depressingly Weak Defense Of His Decision
by Lawrence D'Oliveiro 02 Mar '17

02 Mar '17

Has the godfather of the Web just sold it down the river? <https://www.techdirt.com/articles/20170301/03062936815/tim-berners-lee-endo…>

2 1

Researchers find “severe” flaw in WordPress plugin with 1 million installs
by Peter Reutemann 01 Mar '17

01 Mar '17

'More than 1 million websites running the WordPress content management system may be vulnerable to hacks that allow visitors to snatch password data and secret keys out of databases, at least under certain conditions. The vulnerability stems from a "severe" SQL injection bug in NextGEN Gallery, a WordPress plugin with more than 1 million installations. Until the flaw was recently fixed, NextGEN Gallery allowed input from untrusted visitors to be included in WordPress-prepared SQL queries. Under certain conditions, attackers can exploit the weakness to pipe powerful commands to a Web server's backend database.' -- source: https://arstechnica.com/security/2017/02/severe-vulnerability-in-wordpress-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New $10 Raspberry Pi Zero comes with Wi-Fi and Bluetooth
by Peter Reutemann 01 Mar '17

01 Mar '17

'The newest member of the Raspberry Pi product line costs just $10 plus tax and includes Wi-Fi and Bluetooth capability. The "Raspberry Pi Zero W" is an updated version of the Raspberry Pi Zero. While it lacks some niceties, like Ethernet and full-sized USB-A ports, it's smaller than the flagship Pi and a fraction of the cost. The original Raspberry Pi Zero was released in November 2015 at a price of just $5/£4. The new Pi Zero W is almost identical to the original, but doubles the price to $10 and adds a wireless chip that supports 802.11b/g/n Wi-Fi (2.4GHz-only) and Bluetooth 4.0.' -- source: https://arstechnica.com/information-technology/2017/02/new-10-raspberry-pi-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CSS font-size parameter
by Ian Stewart 27 Feb '17

27 Feb '17

Hi All, There was discussion at last nights meeting regarding the CSS "font-size" property and which units to use. E.g. px (pixels), % (percentage), pt (point), or em (a unit in the field of typography originally based on the width of an "M"), . Note that there are more than just these four units, see here<https://www.w3.org/Style/Examples/007/units.en.html>. If you buy-off on the statements from w3schools.com, then this<http://%20https://www.w3schools.com/TAgs/ref_pxtoemconversion.asp> web-page provides a pixel to em converter, and to quote from their CSS page<https://www.w3schools.com/css/css_font.asp>... "Note: If you do not specify a font size, the default size for normal text, like paragraphs, is 16px (16px=1em)." "The em size unit is recommended by the W3C. 1em is equal to the current font size. The default text size in browsers is 16px. So, the default size of 1em is 16px. The size can be calculated from pixels to em using this formula: pixels/16=em." Although admitting there is much debate over which is the better approach, Kyle Schaeffer, on his website<http://kyleschaeffer.com/development/css-font-size-em-vs-px-vs-pt-vs/>, adds in an addendum from 2011... "Generally, when I create a new design, I will use percent on the body element (body { font-size: 62.5%; }), and then use the em unit to size it from there." Or, for some quotes from wikipedia...<https://en.wikipedia.org/wiki/Em_(typography)> "One em was traditionally defined as the width of the capital M in the current typeface and point size..." "In Cascading Style Sheets, the em unit is the height of the font in nominal points or inches." ...And finally there is one "rem" to save us all... "To make style rules that depend only on the default font size, another unit was developed: the rem. The rem, or root em, is the font size of the root element of the document. Unlike the em, which may be different for each element, the rem is constant throughout the document." More on rem's here<https://www.w3.org/Style/Examples/007/units.en.html#future> cheers, Ian.

1 0

Running Emacs As A Daemon With systemd
by Lawrence D'Oliveiro 26 Feb '17

26 Feb '17

Some instructions here <http://blog.refu.co/?p=1296> for creating a systemd “.service” file for running Emacs. Initially he did it as a privileged systemwide service, then he figured out how to make it per-user without needing special privileges. (Found in a user comment to this article <http://www.phoronix.com/scan.php?page=news_item&px=systemd-233>.)

1 0

Image-To-Image Translation In TensorFlow
by Lawrence D'Oliveiro 24 Feb '17

24 Feb '17

This page <http://affinelayer.com/pixsrv/index.html> lets you create schematic renditions of various kinds of objects, and then synthesize corresponding photorealistic representations of those objects, based on pieces of images taken from the training databases. You can draw your own outlines, or just click the “Random” buttons to see what it does. Results range from entertaining to disturbing.

1 0

“Smart Contracts” May Not Be So Smart
by Lawrence D'Oliveiro 23 Feb '17

23 Feb '17

To review, “smart contracts” are a feature of some blockchain-based systems, which allow an interaction between multiple parties to be encoded as a set of rules which will be executed automatically by the system, so that neither the parties nor anyone else can prevent those rules from being enforced. ... To give just one example, a legal contract need not try to anticipate absolutely every relevant event that might occur. If some weird thing happens that is not envisioned in a regular legal contract, the parties can work out a modification to the contract that seems reasonable to them, and failing that, a judge might decide the outcome, subject to established legal principles. Similarly, a single error or “bug” in writing a regular contract, causing its literal meaning to differ from what the parties intended, is unlikely to lead to extreme results because the legal system will often resolve such a problem by trying to be reasonable. Contrast this with “smart contracts” where a bug in a “contract’s” code can lead to a perverse result that may allow one party to exploit the bug, extracting much of the value out of the arrangement with no recourse for the other parties. That’s what happened with the DAO in Ethereum, leading to a controversial attempt to unwind a legal-according-to-the-rules set of transactions, and dividing the Ethereum community. <http://freedom-to-tinker.com/2017/02/20/smart-contracts-neither-smart-not-c…>

1 0

Catching Fishing Pirates With Signals Analysis
by Lawrence D'Oliveiro 22 Feb '17

22 Feb '17

Every vessel on the ocean broadcasts its identity and location using the automatic identification system (AIS), which is mostly used to prevent ships from colliding. These days it can also be used to track ship locations, as most AIS data is relayed through satellites. If you want to hide on the sea, the first thing you do is make your vessel "dark" by turning off your AIS broadcasts. What's interesting about pirate fishing vessels, however, is that they need to rendezvous with legitimate reefers if they want to get paid for their catch. To find the pirates, Amos told Ars, he and Bergman needed to look for odd patterns in the behavior of reefers. The group partnered with Global Fishing Watch to work on mapping satellite AIS data, and those patterns began to emerge. "Often with reefers they come to a halt in the middle of the ocean," Amos said. "We don’t see other broadcasting vessels, but we can be confident based on what that ship is doing that they must be rendezvousing with dark vessels." <https://arstechnica.com/tech-policy/2017/02/to-catch-a-thief-with-satellite…> I guess this counts as a “big data” application...

1 0

ESA Adopts CC-BY-SA
by Lawrence D'Oliveiro 21 Feb '17

21 Feb '17

The European Space Agency is releasing its images and videos under a Free Creative Commons licence <https://www.theregister.co.uk/2017/02/21/esa_turns_valve_pours_open_images_…>. This kind of thing is long overdue. Though I can imagine some commercial entities not liking the sharealike proviso...

1 0

meeting next Monday
by Peter Reutemann 21 Feb '17

21 Feb '17

Hi everyone We have a meeting coming up next Monday: "With Firefox losing against Chrome and sliding lower and lower in the browser rankings, how about we have a good look at the browsers available for Linux and benchmark them? Michael Cree has been to linux.conf.au recently and will talk a bit about his experience. " More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234743/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When The Internet Of Things Meets The Second-Hand Market
by Lawrence D'Oliveiro 20 Feb '17

20 Feb '17

The global head of IBM's X-Force Red penetration-testing team, Charles Henderson, created a flurry at RSA last week by relating how a connected car app could still access a car he traded in – two years after he'd sold it. ... Henderson feels that none of that should have been possible years after he disposed of the car. Especially as he says he ran a factory reset, reset his garage door and had traded the old car through a factory dealership ... which ... should have revoked his access to the old car. <https://www.theregister.co.uk/2017/02/20/connected_car_in_the_secondhand_lo…> Seems to me this could happen with other kinds of “smart” devices as well.

1 0

Aboard A Cable Survey Ship
by Lawrence D'Oliveiro 17 Feb '17

17 Feb '17

I mention this <http://www.theregister.co.uk/2017/02/16/iregi_tours_submarine_cable_survey_…> because it is scouting out the route for the “Southern Cross NEXT” cable. And also it was formerly an NZ Navy vessel.

1 0

Linus Torvalds: Talk of Tech Innovation is Bullshit. Shut Up and Get the Work Done
by Peter Reutemann 16 Feb '17

16 Feb '17

'Linus Torvalds believes the technology industry's celebration of innovation is smug, self-congratulatory, and self-serving. From a report on The Register: The term of art he used was more blunt: "The innovation the industry talks about so much is bullshit," he said. "Anybody can innovate. Don't do this big 'think different'... screw that. It's meaningless. Ninety-nine per cent of it is get the work done." In a deferential interview at the Open Source Leadership Summit in California on Wednesday, conducted by Jim Zemlin, executive director of the Linux Foundation, Torvalds discussed how he has managed the development of the Linux kernel and his attitude toward work. "All that hype is not where the real work is," said Torvalds. "The real work is in the details." Torvalds said he subscribes to the view that successful projects are 99 per cent perspiration, and one per cent innovation.' -- source: https://linux.slashdot.org/story/17/02/16/1530223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User?s Adventures In Linux
by rowan schischka 16 Feb '17

16 Feb '17

Third party ink works but don't fill up 100% and save OEM ink to periodically flush. I did not use a cheap printer for a few weeks and the third party ink blocked up the plumbing.

1 0

Google's Not-so-secret New OS
by Peter Reutemann 16 Feb '17

16 Feb '17

'According to reports late last year, Google is working on a new operating system called Andromeda. Much about it is still unknown, but according to the documentations Google has provided on its website, it's clear that the Fuchsia is the actual name of the operating system, and the kernel is called Magenta. A tech enthusiast dug around the documentations to share the followings: To my naive eyes, rather than saying Chrome OS is being merged into Android, it looks more like Android and Chrome OS are both being merged into Fuchsia. It's worth noting that these operating systems had previously already begun to merge together to an extent, such as when the Android team worked with the Chrome OS team in order to bring Update Engine to Nougat, which introduced A/B updates to the platform. Google is unsurprisingly bringing up Andromeda on a number of platforms, including the humble Intel NUC. ARM, x86, and MIPS bring-up is exactly what you would expect for an Android successor, and it also seems clear that this platform will run on Intel laptops. My best guess is that Android as an API and runtime will live on as a legacy environment within Andromeda. That's not to say that all development of Android would immediately stop, which seems extremely unlikely. But Google can't push two UI APIs as equal app frameworks over the long term: Mojo is clearly the future. Ah, but what is Mojo? Well it's the new API for writing Andromeda apps, and it comes from Chromium. Mojo was originally created to "extract a common platform out of Chrome's renderer and plugin processes that can support multiple types of sandboxed content."' -- source: https://mobile.slashdot.org/story/17/02/15/1023242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

JavaScript Attack Breaks ASLR On 22 CPU Architectures
by Peter Reutemann 16 Feb '17

16 Feb '17

'Five researchers from the Vrije University in the Netherlands have put together an attack that can be carried out via JavaScript code and break ASLR protection on at least 22 microprocessor architectures from vendors such as Intel, AMD, ARM, Allwinner, Nvidia, and others. The attack, christened ASLRCache, or AnC, focuses on the memory management unit (MMU), a lesser known component of many CPU architectures, which is tasked with improving performance for cache management operations. What researchers discovered was that this component shares some of its cache with untrusted applications, including browsers. This meant that researchers could send malicious JavaScript that specifically targeted this shared memory space and attempted to read its content. In layman's terms, this means an AnC attack can break ASLR and allow the attacker to read portions of the computer's memory, which he could then use to launch more complex exploits and escalate access to the entire OS. Researchers have published two papers [1, 2] detailing the AnC attack, along with two videos[1, 2] showing the attack in action.' -- source: https://developers.slashdot.org/story/17/02/15/2149235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

QOTW
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

Re the Internet of Things: A doctor friend of mine said to me many years ago, "Good thing they won't let you put 'General Protection Fault' down as a cause of death on the certificate." <https://forums.theregister.co.uk/forum/containing/3104004>

1 0

Bruce Schneier At The Open Source Leadership Summit
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

"We all had this special right to code the world as we saw fit," said Schneier. "My guess is we're going to lose that right, because it's too dangerous to give to a bunch of techies." <http://www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_c…>

1 0

Would A Phone That Makes Calls Fly In 2017?
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

A company called HMD Global wants to bring back the legendary Nokia 3310 candy-bar phone <https://arstechnica.com/gadgets/2017/02/report-hmd-to-resurrect-legendary-n…>. You regularly see comments from people lamenting the complexity of modern smartphones, and wishing for a return to the simpler days of mobile phones that were good at making calls, with less of all the extra bells and whistles. As well as having much longer battery life. Now we will see if resurrecting a popular model from the days when phones did exactly that will succeed, given that today making calls is one of the last things that people do with their phones...

3 2

Engineering Around Social Media Border Searches
by rowan schischka 15 Feb '17

15 Feb '17

What happens when the 2-factor authentication text gets sent to my NZ phone number, i cant exactly hand that over. I think ill start a bot that posts cat pictures from a fake account. Give the authorities what they want to see. -- Kind Regards Rowan Schischka

1 0

Now sites can fingerprint you online even when you use multiple browsers
by Peter Reutemann 14 Feb '17

14 Feb '17

'Researchers have recently developed the first reliable technique for websites to track visitors even when they use two or more different browsers. This shatters a key defense against sites that identify visitors based on the digital fingerprint their browsers leave behind.' -- source: https://arstechnica.com/security/2017/02/now-sites-can-fingerprint-you-onli… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Copy-Protection As A Censorship Tool
by Lawrence D'Oliveiro 13 Feb '17

13 Feb '17

There has been ongoing work at the W3C for some time to standardize “Encrypted Media Extensions” (EME), with the usual claims that many publishers will refuse to offer their content without this kind of “protection”. The mitigating argument has been made that such a “feature” would be optional--the browser user could always turn it off. Well, it turns out Google has removed the option to disable its implementation of EME from Chrome. A further worry is that many countries’ copyright laws include provisions that prohibit the circumvention of copy-protection mechanisms. So work by security researchers to audit browsers that implement EME could be interpreted as violations of such provisions. Many have requested that the W3C explicitly state that EME conformance cannot be (ab)used in such a way, but so far it has refused. <https://www.techdirt.com/articles/20170201/14285436609/codification-web-drm…>

1 1

The City Of Munich Now Wants To Abandon Linux And Switch Back to Windows
by Peter Reutemann 12 Feb '17

12 Feb '17

'"The prestigious FOSS project replacing the entire city's administration IT with FOSS based systems, is about to be cancelled and decommissioned," writes long-time Slashdot reader Qbertino. TechRepublic reports: Politicians at open-source champion Munich will next week vote on whether to abandon Linux and return to Windows by 2021. The city authority, which made headlines for ditching Windows, will discuss proposals to replace the Linux-based OS used across the council with a Windows 10-based client. If the city leaders back the proposition it would be a notable U-turn by the council, which spent years migrating about 15,000 staff from Windows to LiMux, a custom version of the Ubuntu desktop OS, and only completed the move in 2013... The use of the open-source Thunderbird email client and LibreOffice suite across the council would also be phased out, in favor of using "market standard products" that offer the "highest possible compatibility" with external and internal software... The full council will vote on whether to back the plan next Wednesday. If all SPD and CSU councillors back the proposal put forward by their party officials, then this new proposal will pass, because the two parties hold the majority. The leader of the Munich Green Party says the city will lose "many millions of euros" if the change is implemented. The article also reports that Microsoft moved its German headquarters to Munich last year.' -- source: https://yro.slashdot.org/story/17/02/11/1930217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored with ho-hum cloud backups? Use Usenet (yes, Usenet!) instead
by Peter Reutemann 11 Feb '17

11 Feb '17

'Cloud backups these days are all the rage—for good reason. Rather than dealing with shuffling physical media offsite, you can simply back up the data offsite, where it can be stored in one of many professionally monitored data centers. Unfortunately, this kind of service isn’t free, and the cost can be a barrier. However, there is a cost-effective way to store your cloud backups: Usenet. With access to a Usenet news server, you can simply upload your backup there, and it will be stored redundantly in news servers all over the world. Best of all, this approach typically costs considerably less than a cloud backup service.' -- source: https://arstechnica.com/information-technology/2017/02/bored-with-ho-hum-cl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle refuses to accept pro-Google “fair use” verdict in API battle
by Peter Reutemann 11 Feb '17

11 Feb '17

'Google successfully made its case to a jury last year that its use of Java APIs in Android was "fair use." A San Francisco federal jury rejected Oracle's claim that the mobile system infringed Oracle's copyrights. But Oracle isn't backing down. Late Friday, the company appealed the high-profile verdict to a federal appeals court. This is the latest stage of a seemingly never-ending legal battle over intellectual property that began in 2010. The conflict has meandered through two federal trials, in addition to multiple trips to the appellate courts and to the Supreme Court. Oracle opened its brief to the US Court of Appeals for the Federal Circuit right where it left off after losing its case. Among other things, Oracle is refusing to believe that the "fair use" defense to copyright-infringement allegations should have protected Google from having to pay billions of dollars in damages.' -- source: https://arstechnica.com/tech-policy/2017/02/oracle-refuses-to-accept-pro-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When A Safety Check Becomes A Point Of Failure...
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

All inbound networking for GCE instances, load balancers and VPN tunnels enter via shared layer 2 load balancers. These load balancers are configured with changes to IP addresses for these resources, then automatically tested in a canary deployment, before changes are globally propagated. The issue was triggered by a large set of updates which were applied to a rarely used load balancing configuration. The application of updates to this configuration exposed an inefficient code path which resulted in the canary timing out. From this point all changes of public addressing were queued behind these changes that could not proceed past the testing phase. In other words, the safety system for validating configuration updates before allowing deployment suffered a failure which blocked all configuration updates thereafter. I guess the answer is to add a watchdog for the canaries ... how many more metaphors can I mix in? <http://www.theregister.co.uk/2017/02/10/google_cloud_outage_explanation/>

1 0

We Finally Have A Computer That Can Survive The Surface Of Venus
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

The Venera landers that the USSR sent to Venus in the 1970s and 1980s were able to survive for up to 2 hours by heavy use of refrigeration and pre-cooling. But now researchers are testing electronics based on silicon carbide, which can work without special protection at very high voltages and temperatures: The chip, a simple 3-stage oscillator, kept functioning [in Venus-like conditions] at a steady 1.26MHz for 521 hours (21.7) days before the [test rig] had to be shut down. <https://arstechnica.co.uk/gadgets/2017/02/venus-computer-chip/>.

1 0

Met Goes Public Domain
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

New York’s Metropolitan Museum of Art is putting 375,000 digitized images online under a Creative Commons CC0 (effectively Public Domain) licence. As Techdirt notes <https://www.techdirt.com/articles/20170208/13005636669/met-goes-public-doma…>, it shouldn’t have to bother specifying such a licence: we should be able to take for granted that digitizations of public-domain works should themselves be public-domain. Unfortunately, others with control over such works (and sizeable legal budgets) think differently. So all kudos to the Met for making this very clear.

2 1

The Right Not To Be Searchable
by Lawrence D'Oliveiro 09 Feb '17

09 Feb '17

“[A] website in Romania ... obtained and posted Canadian judicial and tribunal decisions. These were all public documents, but they were not previously indexed by Google, which meant their contents were effectively hidden. The Romanian site allowed its copies to be indexed by Google, which made the decisions and the Canadian citizens involved visible for the first time -- something the people affected were not happy about. They complained to the Privacy Commissioner of Canada, who ruled that the Romanian site violated Canadian privacy law.” <https://www.techdirt.com/articles/20170208/02314536660/landmark-court-decis…>

1 0

Microsoft hosts the Windows source in a monstrous 300GB Git repository
by Peter Reutemann 07 Feb '17

07 Feb '17

'Microsoft has been working to enhance Git to improve the way it handles vast repositories. Central to this effort is a new project released (in part) as open source Git Virtual File system (GVFS). The premise of GVFS is straightforward enough: rather than fetching all the data at once, only a bare skeleton of the repository needs to be populated up front. The virtualized file system subsequently retrieves additional data on a demand-driven, as-needed basis. Building one particular Windows component, for example, will cause GVFS to fetch the files that make up that component, along with anything that the component depends on, but it will stop short of fetching all the many hundreds of gigabytes the repository contains.' -- source: https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-… I remember using SourceSafe way back. It may not have been great, but it was a big improvement over "not having any" version control. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Intel's Atom C2000 Chips Are Bricking Products – And It's Not Just Cisco Hit
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Certain models of Intel Atom chips are prone to clock-signal failures after about 18 months, rendering them unusable. This seems to be related to a warning put out by Cisco about some of its products, but neither company will confirm there is a link. <http://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product…>

1 0

Chrome 56 Quietly Added Bluetooth Snitch API
by Peter Reutemann 06 Feb '17

06 Feb '17

'When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.' -- source: https://yro.slashdot.org/story/17/02/06/1425208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

25G/50G Ethernet
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Thought there already was a 100-gigabit-per-second Ethernet spec. But it seems that still isn’t quite practical enough (cost? range?) for common use. Nor is the 40-gigabit-per-second fallback. So here we have two more lesser specs: <http://www.theregister.co.uk/2017/01/31/25g_and_50g_ethernet_spec_finalised/>.

1 1

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by rowan schischka 04 Feb '17

04 Feb '17

It will be interesting to see if advertising companies will exploit this. You can see it as an exploit to track users but it should be possible for users to discover who is tracking them -- Rowan Schischka

1 0

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by Peter Reutemann 03 Feb '17

03 Feb '17

'Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.' -- source: https://yro.slashdot.org/story/17/02/02/231229 Not sure whether that applies to Linux/Wine/IE as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Judge Stops PS3 Linux Settlement
by Lawrence D'Oliveiro 03 Feb '17

03 Feb '17

<https://arstechnica.com/tech-policy/2017/02/game-over-for-ps3-linux-settlem…>: “The California judge presiding over the litigation is now killing the proposed settlement amid concerns the lawyers representing the class haven't explained why they should get $2.25 million for their legal services, especially considering that the deal has made it burdensome on gamers to get their cash.” Seems par for the course for class-action settlements, that the lawyers rake it in in fees, while the actual plaintiffs end up with peanuts...

1 0

How Google fought back against a crippling IoT-powered botnet and won
by Peter Reutemann 02 Feb '17

02 Feb '17

'In September, KrebsOnSecurity—arguably the Internet's most intrepid source of security news—was on the receiving end of some of the biggest distributed denial-of-service attacks ever recorded. The site soon went dark after Akamai said it would no longer provide the site with free protection, and no other DDoS mitigation services came forward to volunteer their services. A Google-operated service called Project Shield ultimately brought KrebsOnSecurity back online and has been protecting the site ever since. At the Enigma security conference on Wednesday, a Google security engineer described some of the behind-the-scenes events that occurred shortly after Krebs asked the service for help, and in the months since, they said yes. While there was never significant hesitancy to bring him in, the engineers did what engineers always do—weighed the risks against the benefits. "What happens if this botnet actually takes down google.com and we lose all of our revenue?" Google Security Reliability Engineer Damian Menscher recalls people asking. "But we considered [that] if the botnet can take us down, we're probably already at risk anyway. There's nothing stopping them from attacking us at any time. So we really had nothing to lose here."' -- source: https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gitlab Backups ... What Backups?
by Lawrence D'Oliveiro 02 Feb '17

02 Feb '17

A harried sysadmin accidentally deletes nearly 300GB of data during a troublesome data replication process ... and then they discover that, out of 5 different recovery procedures they thought they had available, none work. <http://www.theregister.co.uk/2017/02/01/gitlab_data_loss/>

2 2

LibreOffice 5.3 Released, Touted As 'One of the Most Feature-Rich Releases' Ever
by Peter Reutemann 02 Feb '17

02 Feb '17

'A new month, and a brand new version of open-source office suite LibreOffice is now available to download. And what a release it is. LibreOffice 5.3 introduces a number of key new features and continues work on improving the look and feel of the app across all major platforms. The Document Foundation describes LibreOffice 5.3 as "one of the most feature-rich releases in the history of the application." One of the headline features is called MUFFIN interface, a new toolbar design similar to the Microsoft Office Ribbon UI.' -- source: https://news.slashdot.org/story/17/02/01/1326204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 GPGPU Server
by Lawrence D'Oliveiro 01 Feb '17

01 Feb '17

System76 announces its new Ibex Pro box <http://www.phoronix.com/scan.php?page=news_item&px=System76-Ibex-Pro-GPU-Se…> which can hold up to nearly 40,000 NVidia CUDA cores <https://system76.com/servers/ibex>. Not sure how many you get for that USD9,575 base price... Seems like there is no really competitive market for GPGPU hardware--it is totally dominated by NVidia, and nobody else gets a serious look-in. So the industry-standard OpenCL API languishes, since the dominant player prefers its own proprietary alternative, and there is little pressure from users to be able to port their code to competing products.

1 0

Google AI on raspberry pi
by rowan schischka 31 Jan '17

31 Jan '17

"Google has developed a huge range of tools for machine learning, IoT, wearables, robotics, and home automation, and it wants Raspberry Pi fans to fill out a survey <https://google.qualtrics.com/jfe/form/SV_3yMNYryaP4WsCwJ?Source=RaspPi> that will help it to understand what tools to provide." http://www.zdnet.com/article/google-is-bringing-ai-to-your-raspberry-pi/ I just took the survey and I don't get any impression of what tools they will bring to the r-pi. It was pretty simple, no email address required to participate. The questions were how old are you, what area are your projects in, and how frequently do you work on your projects. Im sure with the processing power of r-pi we'll see some sort of web API which wouldn't really need to be specific to the r-pi. It will be interesting to watch what they come up with so if you have maker projects, take the survey. -- Rowan Schischka

1 0

Backblaze 2016 Hard Drive Report
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

<https://arstechnica.com/information-technology/2017/01/8tb-hgst-disks-show-…>: Traditionally, the company has stuck with consumer-oriented disks. Backblaze argues that the extra cost of "enterprise" disks doesn't make sense for its usage pattern. Other studies have shown no significant difference in reliability between “enterprise” and “consumer” disks anyway.

2 2

USB-C Power Meter
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

With all the worries over bad USB-C cables and vendors that play fast and loose with the power spec, here <https://arstechnica.co.uk/gadgets/2017/01/usb-c-power-meter/> is a measurement gadget that can help to some extent. But as the article says: If you really want to test a new charger or cable before plugging it into an expensive device, your best bet is some DIYish electronics involving a breakout board and a multimeter. But there doesn't seem to be a plug-and-play version of that yet.

1 0

The Trump-And-Dump Bot
by Lawrence D'Oliveiro 30 Jan '17

30 Jan '17

This bot <http://www.theregister.co.uk/2017/01/30/trumps_corporate_twitter_trolling_t…> analyzes Trump’s tweets, identifies the company he is badmouthing, and does a quick short-sell to profit from the momentary dip in the company’s stock value. T3's approach involves using a Python Twitter bot and API calls to services like Indico for machine learning (sentiment analysis and entity recognition), Clearbit for company identification, Google Finance for stock pricing, and E‑Trade for executing the trade. They have been donating the profits to charity. Imagine that--an ethical use for short-selling...

1 0